The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is configured to run several repository-local Python scripts for validation and feedback collection, such as quick_validate.py and record_skill_feedback.py. These are executed using a specific virtual environment located at ~/.venvs/pyyaml/bin/python.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites to extract design systems, which presents an attack surface for indirect prompt injection. \n
Ingestion points: Website content is ingested via the target_url and converted into a markdown corpus (as described in SKILL.md and contract.yaml). \n
Boundary markers: The instructions do not define specific delimiters or warnings to help the agent distinguish between its system instructions and the potentially untrusted content from the source URL. \n
Capability inventory: The agent has permissions to write deliverables to the ./artifacts/ or /mnt/data/ directories and to execute local scripts in the utilities/ folder. \n
Sanitization: Although the skill instructs the agent to redact PII and secrets, it lacks instructions for sanitizing or ignoring natural language instructions that might be hidden in the HTML or markdown of the target website.
[PROMPT_INJECTION]: The skill includes strong negative test cases in references/evals.yaml (e.g., pressure-prompt-injection) and constraints in SKILL.md that explicitly instruct the agent to refuse attempts to bypass safety guidelines or scrape unauthorized content.

ui-cloner